CVSS: 9.4EPSS: 1%CPEs: 7EXPL: 0CVE-2014-8567 – mod_auth_mellon: logout processing leads to denial of service
https://notcve.org/view.php?id=CVE-2014-8567
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data. El módulo mod_auth_mellon anterior a 0.8.1 permite a atacantes remotos causar una denegación de servicio (caída del servidor Apache HTTP) a través de una petición de apagado del servicio Apache manipulada. It was found that uninitialized data could be accessed when processing a user's logout request. By attempting to log out, a user could possibly cause the Apache HTTP Server to crash. • http://linux.oracle.com/errata/ELSA-2014-1803.html http://rhn.redhat.com/errata/RHSA-2014-1803.html http://secunia.com/advisories/62094 http://secunia.com/advisories/62125 https://github.com/UNINETT/mod_auth_mellon/commit/0f5b4fd860fa7e3a6c47201637aab05395f32647 https://postlister.uninett.no/sympa/arc/modmellon/2014-11/msg00000.html https://access.redhat.com/security/cve/CVE-2014-8567 https://bugzilla.redhat.com/show_bug.cgi?id=1157954 • CWE-399: Resource Management Errors •
CVSS: 6.4EPSS: 2%CPEs: 2EXPL: 0CVE-2014-8566 – mod_auth_mellon: remote memory disclosure flaw
https://notcve.org/view.php?id=CVE-2014-8566
The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of service (segmentation fault) via unspecified vectors related to a "session overflow" involving "sessions overlapping in memory." El modulo mod_auth_mellon anterior a 0.8.1 permite a atacantes remotos obtener información sensible o causar una denegación de servicio (fallo en la segmentación) a través de vectores sin especificar, relacionado con un 'desbordamiento de sesión' que implica 'la superposición de sesiones en la memoria'. An information disclosure flaw was found in mod_auth_mellon's session handling that could lead to session overlapping in memory. A remote attacker could potentially use this flaw to obtain data from another user's session. • http://linux.oracle.com/errata/ELSA-2014-1803.html http://rhn.redhat.com/errata/RHSA-2014-1803.html http://secunia.com/advisories/62094 http://secunia.com/advisories/62125 https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.8.1 https://postlister.uninett.no/sympa/arc/modmellon/2014-11/msg00000.html https://access.redhat.com/security/cve/CVE-2014-8566 https://bugzilla.redhat.com/show_bug.cgi?id=1157281 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.4EPSS: 0%CPEs: 18EXPL: 0CVE-2012-4566
https://notcve.org/view.php?id=CVE-2012-4566
The DTLS support in radsecproxy before 1.6.2 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof clients, a different vulnerability than CVE-2012-4523. El soporte DTLS en radsecproxy antes de v1.6.2 no verifica correctamente certificados cuando hay bloques de configuración con la configuración de CA que no están relacionados con el bloque que está siendo utilizado para comprobar la cadena de certificados, lo que podría permitir a atacantes remotos evitar las restricciones de acceso previstas y suplantar clientes, una vulnerabilidad diferente a CVE-2012-4523. • http://git.nordu.net/?p=radsecproxy.git%3Ba=commit%3Bh=3682c935facf5ccd7fa600644bbb76957155c680 http://secunia.com/advisories/51251 http://www.debian.org/security/2012/dsa-2573 http://www.openwall.com/lists/oss-security/2012/10/17/7 http://www.openwall.com/lists/oss-security/2012/10/31/6 https://postlister.uninett.no/sympa/arc/radsecproxy/2012-09/msg00001.html https://postlister.uninett.no/sympa/arc/radsecproxy/2012-10/msg00001.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.4EPSS: 0%CPEs: 17EXPL: 0CVE-2012-4523
https://notcve.org/view.php?id=CVE-2012-4523
radsecproxy before 1.6.1 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof clients. radsecproxy antes de v1.6.1 no verifica correctamente certificados cuando hay bloques de configuración con la configuración de CA que no están relacionados con el bloque que está siendo utilizado para comprobar la cadena de certificados, lo que podría permitir a atacantes remotos evitar las restricciones de acceso previstas y suplantar clientes. • http://secunia.com/advisories/51251 http://www.debian.org/security/2012/dsa-2573 http://www.openwall.com/lists/oss-security/2012/10/17/7 http://www.openwall.com/lists/oss-security/2012/10/31/6 http://www.securityfocus.com/bid/56105 https://postlister.uninett.no/sympa/arc/radsecproxy/2012-09/msg00001.html https://postlister.uninett.no/sympa/arc/radsecproxy/2012-09/msg00006.html https://project.nordu.net/browse/RADSECPROXY-43 • CWE-264: Permissions, Privileges, and Access Controls •